Overview
overview
6Static
static
1Wick10k Ze...ts.zip
windows10-2004-x64
1Wick10k Ze...ts.zip
windows11-ltsc_2024-x64
1Wick10k Ze...ng.wav
windows10-2004-x64
6Wick10k Ze...ng.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ng.wav
windows10-2004-x64
6Wick10k Ze...ng.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ng.wav
windows10-2004-x64
6Wick10k Ze...ng.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ng.wav
windows10-2004-x64
6Wick10k Ze...ng.wav
windows11-ltsc_2024-x64
1Wick10k Ze...rd.wav
windows10-2004-x64
6Wick10k Ze...rd.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ll.wav
windows10-2004-x64
6Wick10k Ze...ll.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ey.wav
windows10-2004-x64
6Wick10k Ze...ey.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ng.wav
windows10-2004-x64
6Wick10k Ze...ng.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ey.wav
windows10-2004-x64
6Wick10k Ze...ey.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ey.wav
windows10-2004-x64
6Wick10k Ze...ey.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ey.wav
windows10-2004-x64
6Wick10k Ze...ey.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ad.wav
windows10-2004-x64
6Wick10k Ze...ad.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ng.wav
windows10-2004-x64
6Wick10k Ze...ng.wav
windows11-ltsc_2024-x64
1Wick10k Ze...no.wav
windows10-2004-x64
6Wick10k Ze...no.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ad.wav
windows10-2004-x64
6Wick10k Ze...ad.wav
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 14:41
Static task
static1
Behavioral task
behavioral1
Sample
Wick10k Zenology Bank @wick_kid_beats.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Wick10k Zenology Bank @wick_kid_beats.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/Sweeper - Pulsating.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/Sweeper - Pulsating.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/TechnoVirus - Pulsating.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/TechnoVirus - Pulsating.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/ThrobulaxMod - Pulsating.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/ThrobulaxMod - Pulsating.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/TotalDramaIsland - Pulsating.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/TotalDramaIsland - Pulsating.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/TrapAHolics - Harpsichord.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/TrapAHolics - Harpsichord.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/TrapBell - Bell.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/TrapBell - Bell.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/Union - Synth Polykey.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/Union - Synth Polykey.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/VaporizeSweep - Pulsating.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/VaporizeSweep - Pulsating.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/VoxChoir - Synth Polykey.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/VoxChoir - Synth Polykey.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/WantItAll - Synth Polykey.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/WantItAll - Synth Polykey.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/Wants&Needs - Synth Polykey.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/Wants&Needs - Synth Polykey.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/Weary - Lead.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/Weary - Lead.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/WeatherReport - Pulsating.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/WeatherReport - Pulsating.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/WiseKey - E Piano.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/WiseKey - E Piano.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/WorryBoutNow - Lead.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/WorryBoutNow - Lead.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target Wick10k Zenology Bank @wick_kid_beats/OneShots/TechnoVirus - Pulsating.wav
- Size 2.8MB
- Sample260802-r2taxabr21
- SHA256 6f5fe45a10743867ec22937a60880c41712d3efe3f9752d39d0701c3fa0024eb
- MD5 d9af76a48e2e0d0a1ec8a9ad809d6c07
- SHA1 f3edf0333de4f8027dc292e0623f68f33414314b
- SHA512 6475449ccd68b958197a2562f3f940eadac8e2a88394b57c6e9c80c9e9d9c7cd47ad297ce845df0ae829e0c741299b46713ea773000c4e56aa95545b519f3059
- SSDEEP 49152:VYVAsFnQfX9JgMsH1kuWZWGMtjcJRDz5ItO8lfGf36dpsStf6eoFrplR/Kcgxj0k:VGAslQ1JgHLGWGMyJVz5iOIGfkpttye3
- TLSH T19FD533F3425A629BE984103BB6C08B533EE3F549577508EE2A9464848FEBD5F94E03DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{A49A7FB3-F850-4424-BEA7-970C17645240} wmplayer.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 6108 wmplayer.exe Token: SeCreatePagefilePrivilege 6108 wmplayer.exe Token: SeShutdownPrivilege 5316 unregmp2.exe Token: SeCreatePagefilePrivilege 5316 unregmp2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 6108 wmplayer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 6108 wrote to memory of 5280 6108 wmplayer.exe 86 PID 5280 wrote to memory of 5316 5280 unregmp2.exe 87
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\Wick10k Zenology Bank @wick_kid_beats\OneShots\TechnoVirus - Pulsating.wav"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:5316
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:3532
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 64KB
- SHA256 f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
- MD5 987a07b978cfe12e4ce45e513ef86619
- SHA1 22eec9a9b2e83ad33bedc59e3205f86590b7d40c
- SHA512 39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa
- SSDEEP 3:Akallkltlsl7pl+e/lls4XplsMlOI1Xlldl0lcNklltlwzl4hR/mll:AN+1E3+e9XplskOI10cAe
- TLSH T1FD539204E3609562C8048377A4EA0B47B331F0690A1AEB1B602A64381C422DA2CA0180
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 4630131692688388942697aacf5dcbc1abf49e6d67dc40849a38b78c65a74fce
- MD5 26977faf6e33dc787f8d6adae651d809
- SHA1 ce3dee42f53f29de912bc27bd6b623ae1f648120
- SHA512 332cf87a17d97dd94bb27257447c3935b887477dd276d3a7f0f2e7612ffe5308bc5631e5eb17e5947407584d86997ee02187076ab4e7673e4ab345fab48ccf3a
- SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbav:rZP2tFP3vqY89qEMoTaBacgZFr
- TLSH T110257437D190B0C5CE2CB171E9ED8F09BA23B10B11A052465FF8957E7A633D99D0B1EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 7e32a9376e0891812578f22fa35f757a12b928c03baf6ef87a2c93074fc5a1be
- MD5 d9ee559bc02d5201e13aa9a88011efba
- SHA1 a36f87880d1aaf8dc2e8415f29e042dde7f599d8
- SHA512 ca48c0cc6efdffa963c8196540a72e4183d3a59a3f8640e9f19ae0dc8bde99db3d2a0c8556ad4439eee8e4f92cd656bfd1ae3cd4057b0f6a11da0c737a867478
- SSDEEP 96:Ytp3gERl5u1/ADS+wltcNXtFUMUst97XtWUMbstEyUMlstyOXt/L2tELXtctzAt+:YtpwERl5u1/ADbLnSnxynq
- TLSH T17563F51552E496A9F3F7AEB179F764232E3A79A05E3BE10C4214435D0E61F68DE30B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
- Size 498B
- SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
- MD5 90be2701c8112bebc6bd58a7de19846e
- SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
- SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
- TLSH T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 f9095f225d96b4aacd4926eb45474ec47daacab5c6531979715878df5838a19b
- MD5 47203aa057ad1aece0cdfa190199d232
- SHA1 c3e44a1d14631ce9b8d384cf68213c091292640e
- SHA512 9f7ddc7e77498fa6ea1a0008bbc94b3b1f34f850d60e80d959821f754c43578942a59c76d3015992551f15ce62a75a1047ac2eedb19a2065226fe2b28539764c
- TLSH T11B218B971B8DD47089E11BE76DEC8E2573BBC7CA8790D0A5B349A039480316D5B3D16D
- MD5 SHA1 SHA512 TLSH